CVE-2026-16033

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-16033
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16033.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-16033
Aliases
  • GHSA-9hcm-hxh5-7xxh
Downstream
Published
2026-08-12T20:11:08.781Z
Modified
2026-08-15T11:31:11.520343174Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Arbitrary file read+write on host via templates/ symlink in malicious image
Details

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16033.json",
    "cna_assigner": "canonical"
}
References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/lxd
Events
Introduced
03aab09f5b5cbdada00c6539877dcf5932fcde98
Fixed
a55c9d0228552323d96cc330fb36f9471581c4ab
Introduced
1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1
Fixed
58b58151cfc3bd9fb0fedce26fcdd73a3e67bdb8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.12"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

lxd-4.*
lxd-4.0.0
lxd-4.0.1
lxd-4.0.11
lxd-4.0.2
lxd-4.0.3
lxd-4.0.4
lxd-4.0.5
lxd-4.0.6
lxd-4.0.7
lxd-4.0.8
lxd-4.0.9
lxd-5.*
lxd-5.0.0
lxd-5.0.1
lxd-5.0.2
lxd-5.0.7
Other
show

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16033.json"